Uninstall Cloud Endpoint from Mac OS with Tamper Protection Enabled

Applies to the following Sophos products and versions

Sophos Cloud Endpoint.

Disable Tamper Protection with Terminal

You can disable tamper protection by following the below steps:

1. Open Terminal
2. Type sudo defaults write /Library/Preferences/com.sophos.sav TamperProtectionEnabled -bool false
3. Enter the administrator password

Disable Tamper Protection with Xcode

To disable Tamper Protection go to .library/preferences /com.sophos.sav. If you have a Xcode application open this file and set the Boolean value to "NO".

Disable Tamper Protection with TextEdit

1. If Xcode is not installed on the system, open the file via TextEdit. Make a copy of the original file before editing.
2. There will be a key line <key>TamperProtectionEnabled<key><True/> change to False. 
3. Once the com.sophos.sav.plist file is edited, terminate the process via Activity Monitor.

NOTE: If overwriting the file, make sure you save it as .plist

Removal with Terminal - v9.2+ installation managed by Sophos Cloud

1. Open Terminal and run the following command to change to the correct directory:
   cd /Library/Application\ Support/Sophos/saas/Installer.app/Contents/MacOS/tools/
2. Run the following command: 
   sudo ./InstallationDeployer --remove

Removal with Terminal - v9.2+ standalone installation

1. Open Terminal and run the following command to change to the correct directory:
   cd /Library/Application\ Support/Sophos/opm-sa/Installer.app/Contents/MacOS/tools/
2. Run the following command:
   sudo ./InstallationDeployer --remove